---
id: CVE-2026-71206
title: >-
  Shiori's CheckToken function (internal/domains/auth.go) validates only the
  JWT's HMAC signature and returns the embedded claims.Account object
  unmodified, never re-fetching the account from the database
summary: >-
  Shiori's CheckToken function (internal/domains/auth.go) validates only the
  JWT's HMAC signature and returns the embedded claims.Account object
  unmodified, never re-fetching the account from the database. No session store
  or token-revocat…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-613
published: '2026-08-05'
updated: '2026-08-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71206'
references:
  - url: 'https://github.com/go-shiori/shiori'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
tags:
  - nvd
  - exploit-available
epss: 0.00374
epssPercentile: 0.28614
ingestedAt: '2026-08-10T12:39:48.325Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Nel-droid/CVE-2026-71206-PoC'
  checkedAt: '2026-09-26T09:05:57.763Z'
exploitAvailable: true
---

## Overview

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.